sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-20 21:59:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

[client] Verify rootless state reuse with a stable UID

Browse Source 
Persisted profiles remain scoped to the creating UID. Verify same-UID container recreation without broadening application permissions, and document the Kubernetes volume permission behavior observed on OpenShift. Remove unused synthetic-user home metadata.
This commit is contained in:
jnfrati
2026-09-08 10:49:10 +02:00
parent e9bea322fa
commit 6cff570022
4 changed files with 54 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/Dockerfile-rootless
+5
View File
@@ -3,6 +3,11 @@
# CGO_ENABLED=0 go build -o netbird ./client
# podman build -t localhost/netbird:latest -f client/Dockerfile-rootless --ignorefile .dockerignore-client .
# podman run --rm -it --user 1001230000:0 --cap-drop=ALL --security-opt=no-new-privileges localhost/netbird:latest
#
# Reuse /var/lib/netbird volumes with the same runtime UID.
# Config/profile files start at 0600; Kubernetes fsGroup may widen their modes.
# Where supported, pod securityContext.fsGroupChangePolicy: OnRootMismatch
# preserves modes when the volume root's ownership and permissions match.
FROM alpine:3.24